@maronn-openid-connect/cli 0.0.1 → 0.1.1

package/dist/frameworks/hono/templates.js

@@ -495,6 +495,83 @@ export function createInMemoryClientResolver(
 `;
 }
 export function storeTemplate(corePkg, features = DEFAULT_FEATURES) {
+    const transactionBindingHelpers = features.transactionBinding
+        ? `
+/**
+ * Auth transaction binding cookie - OIDC Core 1.0 Section 3.1.2.3 / 3.1.2.4.
+ *
+ * Why this exists: transaction_id travels in the URL, so it can leak through
+ * browser history, access logs or a shared screen. Without a second factor the
+ * OP cannot tell the browser that started the authorization request from anyone
+ * who merely knows that id, and that lets a third party read csrf_token off the
+ * consent page and finish the flow. Worse, an attacker can start a flow with
+ * their OWN client, lure the victim to /login?transaction_id=<attacker's> and
+ * have the victim's authorization code delivered to the attacker's client - a
+ * case the RP's state check cannot catch. Binding the transaction to a secret
+ * this browser holds in an HttpOnly cookie is the OP-side defense.
+ *
+ * The cookie name embeds the transaction id so two tabs can run two
+ * authorization flows at once without overwriting each other's secret. The
+ * cookie carries the raw secret; only its SHA-256 hash is stored on the
+ * transaction, so leaking the transaction store does not yield a usable cookie.
+ */
+export const TRANSACTION_BINDING_COOKIE_PREFIX = 'oidc_txn_';
+
+/**
+ * Build the Set-Cookie value binding a transaction to this browser.
+ * Same attributes as the session cookie: HttpOnly (no JS access), Secure
+ * (HTTPS only; http://localhost is treated as trustworthy by browsers) and
+ * SameSite=Lax, because SameSite=Strict would drop the cookie on the cross-site
+ * navigation that starts the flow. Max-Age matches the transaction TTL so
+ * abandoned flows do not leave cookies behind. When the OP is always served
+ * over HTTPS, prefixing the name with '__Host-' is recommended.
+ */
+export function buildTransactionBindingCookie(
+  transactionId: string,
+  bindingSecret: string,
+  ttlSeconds: number,
+): string {
+  return (
+    TRANSACTION_BINDING_COOKIE_PREFIX + transactionId + '=' + bindingSecret +
+    '; HttpOnly; Secure; SameSite=Lax; Path=/; Max-Age=' + String(ttlSeconds)
+  );
+}
+
+/**
+ * Build the Set-Cookie value that clears a transaction binding cookie once the
+ * transaction is finished (code issued or access denied), so the browser does
+ * not accumulate one cookie per completed flow.
+ */
+export function buildClearedTransactionBindingCookie(transactionId: string): string {
+  return (
+    TRANSACTION_BINDING_COOKIE_PREFIX + transactionId +
+    '=; HttpOnly; Secure; SameSite=Lax; Path=/; Max-Age=0'
+  );
+}
+
+/**
+ * Extract the binding secret for one transaction from a Cookie request header.
+ * Returns undefined when the header is missing or this transaction's cookie is
+ * absent, which validateTransactionBinding() rejects.
+ */
+export function parseTransactionBindingSecret(
+  cookieHeader: string | null,
+  transactionId: string,
+): string | undefined {
+  if (!cookieHeader) return undefined;
+  const name = TRANSACTION_BINDING_COOKIE_PREFIX + transactionId;
+  for (const part of cookieHeader.split(';')) {
+    const trimmed = part.trim();
+    const eq = trimmed.indexOf('=');
+    if (eq === -1) continue;
+    if (trimmed.slice(0, eq) === name) {
+      return trimmed.slice(eq + 1);
+    }
+  }
+  return undefined;
+}
+`
+        : '';
     const parStoreTypeImport = features.par
         ? `
 import type {
@@ -823,7 +900,7 @@ export function parseSessionId(cookieHeader: string | null): string | undefined
 export function buildSessionCookie(sessionId: string): string {
   return SESSION_COOKIE_NAME + '=' + sessionId + '; HttpOnly; Secure; SameSite=Lax; Path=/';
 }
-
+${transactionBindingHelpers}
 /**
  * In-memory consent store. Records that a user granted a set of scopes to a
  * client so prompt=none can confirm consent without showing UI
@@ -1600,6 +1677,44 @@ export async function revokeConsentAndTokens(subject: string, clientId: string):
 `;
 }
 export function authorizeRouteTemplate(corePkg, features = DEFAULT_FEATURES) {
+    const bindingCoreImport = features.transactionBinding
+        ? `
+  computeTransactionBindingHash,`
+        : '';
+    const bindingStoreImport = features.transactionBinding
+        ? `
+  buildTransactionBindingCookie,`
+        : '';
+    const bindingSecretStep = features.transactionBinding
+        ? `    // OIDC Core 1.0 Section 3.1.2.3 / 3.1.2.4: the End-User who authenticates and
+    // consents must be the one behind THIS User-Agent. transaction_id alone cannot
+    // prove that (it rides in the URL and can leak), so a secret is handed to this
+    // browser in an HttpOnly cookie and only its hash is kept on the transaction.
+    // See buildTransactionBindingCookie() in store.ts for the threat this closes.
+    const bindingSecret = await generateRandomString(32);
+    const transaction = createAuthTransaction(validatedRequest, csrfToken, {
+      bindingHash: await computeTransactionBindingHash(bindingSecret),
+    });
+`
+        : `    const transaction = createAuthTransaction(validatedRequest, csrfToken);
+`;
+    const bindingCookieOnConsentRedirect = features.transactionBinding
+        ? `          // Hand the binding secret to this browser before the interactive steps.
+          // Only paths that continue in the browser get the cookie; paths that
+          // redirect straight back to the client never needed one.
+          c.header(
+            'Set-Cookie',
+            buildTransactionBindingCookie(transactionId, bindingSecret, transactionTtlSeconds),
+          );
+`
+        : '';
+    const bindingCookieOnLoginRedirect = features.transactionBinding
+        ? `    c.header(
+      'Set-Cookie',
+      buildTransactionBindingCookie(transactionId, bindingSecret, transactionTtlSeconds),
+    );
+`
+        : '';
     const requestObjectImports = features.requestObject
         ? `
   resolveRequestObjectParams,
@@ -1736,7 +1851,7 @@ import {
   parseAudienceParameter,
   parseClaimsRequestParameter,
   validateIdTokenHint,
-  createAuthTransaction,
+  createAuthTransaction,${bindingCoreImport}
   createAuthorizationCode,
   completeAuthTransaction,
   generateRandomString,
@@ -1754,7 +1869,7 @@ import { clientResolver as defaultClientResolver } from '../resolvers.js';
 import {
   transactionStore as defaultTransactionStore,
   authCodeStore as defaultAuthCodeStore,
-  authSessionStore as defaultAuthSessionStore,
+  authSessionStore as defaultAuthSessionStore,${bindingStoreImport}
 } from '../store.js';
 import { defaultViews, renderView } from '../views.js';${parImports}
 
@@ -1958,14 +2073,14 @@ ${offlineAccessStep}
 
     // Create authentication transaction
     const csrfToken = await generateRandomString(32);
-    const transaction = createAuthTransaction(validatedRequest, csrfToken);
-    const transactionId = await generateRandomString(32);
+${bindingSecretStep}    const transactionId = await generateRandomString(32);
 
     // Store transaction
+    const transactionTtlSeconds = 10 * 60; // 10 minutes TTL
     await transactionStore.put(
       'auth_txn:' + transactionId,
       transaction,
-      10 * 60, // 10 minutes TTL
+      transactionTtlSeconds,
     );
 
     // OIDC Core 1.0 Section 3.1.2.1: prompt is a space-delimited list
@@ -2179,7 +2294,7 @@ ${offlineAccessStep}
             subject: existingSession.subject,
             authTime: existingSession.authTime,
           });
-          const consentUrl = new URL('/consent', c.req.url);
+${bindingCookieOnConsentRedirect}          const consentUrl = new URL('/consent', c.req.url);
           consentUrl.searchParams.set('transaction_id', transactionId);
           return c.redirect(consentUrl.toString());
         }
@@ -2187,7 +2302,7 @@ ${offlineAccessStep}
     }
 
     // Redirect to login page (prompt=login forces re-authentication; handled in login route)
-    const loginUrl = new URL('/login', c.req.url);
+${bindingCookieOnLoginRedirect}    const loginUrl = new URL('/login', c.req.url);
     loginUrl.searchParams.set('transaction_id', transactionId);
     return c.redirect(loginUrl.toString());
   } catch (error) {
@@ -3713,11 +3828,83 @@ ${rfc8414Comment}${introspectionMetadata}${revocationMetadata}  });
 });
 `;
 }
-export function loginRouteTemplate(corePkg) {
+export function loginRouteTemplate(corePkg, features = DEFAULT_FEATURES) {
+    const bindingImports = features.transactionBinding
+        ? `
+  validateTransactionBinding,
+  AuthTransactionError,
+  type AuthTransaction,`
+        : '';
+    const bindingStoreImport = features.transactionBinding
+        ? `
+  parseTransactionBindingSecret,`
+        : '';
+    const bindingGuard = features.transactionBinding
+        ? `
+/**
+ * Enforce that this step comes from the User-Agent that started the transaction
+ * (OIDC Core 1.0 Section 3.1.2.3 / 3.1.2.4). Returns an error Response to send
+ * back, or undefined when the binding holds.
+ *
+ * The failure is rendered by the OP itself and never redirected to the client's
+ * redirect_uri: at this point we cannot tell whose transaction this is, so
+ * answering the client would leak that a transaction exists — and, in the
+ * lured-victim case, would hand the attacker's client a code for the victim.
+ * See buildTransactionBindingCookie() in store.ts for the full threat model.
+ */
+async function rejectUnboundTransaction(
+  transaction: AuthTransaction,
+  transactionId: string,
+  cookieHeader: string | null,
+  views: typeof defaultViews,
+): Promise<Response | undefined> {
+  try {
+    await validateTransactionBinding(
+      transaction,
+      parseTransactionBindingSecret(cookieHeader, transactionId),
+    );
+    return undefined;
+  } catch (error) {
+    if (!(error instanceof AuthTransactionError)) throw error;
+    return renderView(views.errorPage({
+      error: error.message,
+      statusCode: error.httpStatusCode,
+    }), { status: error.httpStatusCode });
+  }
+}
+`
+        : '';
+    const bindingCheckBeforeLoginForm = features.transactionBinding
+        ? `
+  // Checked BEFORE rendering: the login page embeds csrf_token, so anyone who
+  // could load this page with a leaked transaction_id would obtain the token
+  // that the POST handlers validate.
+  const bindingError = await rejectUnboundTransaction(
+    transaction,
+    transactionId,
+    c.req.header('Cookie') ?? null,
+    views,
+  );
+  if (bindingError) return bindingError;
+`
+        : '';
+    const bindingCheckBeforeLoginCsrf = features.transactionBinding
+        ? `  // Checked before validateCsrfToken: the CSRF token only proves the request
+  // carries a value from the form, and that form is reachable by anyone holding
+  // transaction_id. The binding proves it is the same browser.
+  const bindingError = await rejectUnboundTransaction(
+    transaction,
+    transactionId,
+    c.req.header('Cookie') ?? null,
+    views,
+  );
+  if (bindingError) return bindingError;
+`
+        : '';
     return `import { Hono } from 'hono';
 import {
   getAuthTransaction,
-  validateCsrfToken,
+  validateCsrfToken,${bindingImports}
   handleLoginFailure,
   generateRandomString,
 } from '${corePkg}';
@@ -3726,13 +3913,13 @@ import {
   authSessionStore as defaultAuthSessionStore,
   browserSessionStore as defaultBrowserSessionStore,
   buildSessionCookie,
-  parseSessionId,
+  parseSessionId,${bindingStoreImport}
   userStore,
 } from '../store.js';
 import { defaultViews, renderView } from '../views.js';
 
 export const loginApp = new Hono<{ Variables: Record<string, any> }>();
-
+${bindingGuard}
 /**
  * Login Page - GET
  * Displays the login form for user authentication.
@@ -3746,7 +3933,7 @@ loginApp.get('/', async (c) => {
   const views = c.get('views') ?? defaultViews;
   const transactionStore = c.get('transactionStore') ?? defaultTransactionStore;
   const transaction = await getAuthTransaction(transactionId, transactionStore);
-
+${bindingCheckBeforeLoginForm}
   return renderView(views.loginPage({
     transactionId,
     csrfToken: transaction.csrfToken,
@@ -3775,7 +3962,7 @@ loginApp.post('/', async (c) => {
     ((u: string, p: string) => userStore.authenticate(u, p));
 
   const transaction = await getAuthTransaction(transactionId, transactionStore);
-  validateCsrfToken(transaction, csrfToken);
+${bindingCheckBeforeLoginCsrf}  validateCsrfToken(transaction, csrfToken);
 
   // Authenticate user
   const user = await authenticateUser(username, password);
@@ -3832,11 +4019,96 @@ loginApp.post('/', async (c) => {
 });
 `;
 }
-export function consentRouteTemplate(corePkg) {
+export function consentRouteTemplate(corePkg, features = DEFAULT_FEATURES) {
+    const bindingImports = features.transactionBinding
+        ? `
+  validateTransactionBinding,
+  AuthTransactionError,
+  type AuthTransaction,`
+        : '';
+    const bindingStoreImport = features.transactionBinding
+        ? `
+  buildClearedTransactionBindingCookie,
+  parseTransactionBindingSecret,`
+        : '';
+    const bindingGuard = features.transactionBinding
+        ? `
+/**
+ * Enforce that this step comes from the User-Agent that started the transaction
+ * (OIDC Core 1.0 Section 3.1.2.3 / 3.1.2.4). Returns an error Response to send
+ * back, or undefined when the binding holds.
+ *
+ * The failure is rendered by the OP itself and never redirected to the client's
+ * redirect_uri: without a verified owner, answering the client would let an
+ * attacker who lured a victim into their own transaction collect a code for the
+ * victim's identity. See buildTransactionBindingCookie() in store.ts.
+ */
+async function rejectUnboundTransaction(
+  transaction: AuthTransaction,
+  transactionId: string,
+  cookieHeader: string | null,
+  views: typeof defaultViews,
+): Promise<Response | undefined> {
+  try {
+    await validateTransactionBinding(
+      transaction,
+      parseTransactionBindingSecret(cookieHeader, transactionId),
+    );
+    return undefined;
+  } catch (error) {
+    if (!(error instanceof AuthTransactionError)) throw error;
+    return renderView(views.errorPage({
+      error: error.message,
+      statusCode: error.httpStatusCode,
+    }), { status: error.httpStatusCode });
+  }
+}
+`
+        : '';
+    const bindingCheckBeforeConsentForm = features.transactionBinding
+        ? `
+  // Checked BEFORE rendering: the consent page embeds csrf_token, so a third
+  // party holding a leaked transaction_id must not be able to read it here and
+  // then complete POST /consent on the End-User's behalf.
+  const bindingError = await rejectUnboundTransaction(
+    transaction,
+    transactionId,
+    c.req.header('Cookie') ?? null,
+    views,
+  );
+  if (bindingError) return bindingError;
+`
+        : '';
+    const bindingCheckBeforeConsentCsrf = features.transactionBinding
+        ? `  // Checked before validateCsrfToken and before any decision is acted on: this
+  // is the step that mints the authorization code, so an unbound caller must not
+  // reach it — neither to approve nor to deny on the End-User's behalf.
+  const bindingError = await rejectUnboundTransaction(
+    transaction,
+    transactionId,
+    c.req.header('Cookie') ?? null,
+    views,
+  );
+  if (bindingError) return bindingError;
+`
+        : '';
+    const clearBindingCookieOnDeny = features.transactionBinding
+        ? `    // The transaction is over; drop its binding cookie so the browser does not
+    // keep one cookie per finished flow.
+    c.header('Set-Cookie', buildClearedTransactionBindingCookie(transactionId));
+`
+        : '';
+    const clearBindingCookieOnSuccess = features.transactionBinding
+        ? `  // The transaction is over; drop its binding cookie so the browser does not
+  // keep one cookie per finished flow.
+  c.header('Set-Cookie', buildClearedTransactionBindingCookie(transactionId));
+
+`
+        : '';
     return `import { Hono } from 'hono';
 import {
   getAuthTransaction,
-  validateCsrfToken,
+  validateCsrfToken,${bindingImports}
   completeAuthTransaction,
   createAuthorizationCode,
 } from '${corePkg}';
@@ -3847,12 +4119,12 @@ import {
 import {
   transactionStore as defaultTransactionStore,
   authCodeStore as defaultAuthCodeStore,
-  authSessionStore as defaultAuthSessionStore,
+  authSessionStore as defaultAuthSessionStore,${bindingStoreImport}
 } from '../store.js';
 import { defaultViews, renderView } from '../views.js';
 
 export const consentApp = new Hono<{ Variables: Record<string, any> }>();
-
+${bindingGuard}
 /**
  * Consent Page - GET
  * Displays the consent form for scope authorization.
@@ -3866,7 +4138,7 @@ consentApp.get('/', async (c) => {
   const views = c.get('views') ?? defaultViews;
   const transactionStore = c.get('transactionStore') ?? defaultTransactionStore;
   const transaction = await getAuthTransaction(transactionId, transactionStore);
-
+${bindingCheckBeforeConsentForm}
   return renderView(views.consentPage({
     transactionId,
     csrfToken: transaction.csrfToken,
@@ -3892,7 +4164,7 @@ consentApp.post('/', async (c) => {
   const clientResolver = c.get('clientResolver') ?? defaultClientResolver;
 
   const transaction = await getAuthTransaction(transactionId, transactionStore);
-  validateCsrfToken(transaction, csrfToken);
+${bindingCheckBeforeConsentCsrf}  validateCsrfToken(transaction, csrfToken);
 
   // RFC 9207 §2: include the issuer identifier on every authorization response
   // (success and error) so clients can pin the issuer that produced the response.
@@ -3908,7 +4180,7 @@ consentApp.post('/', async (c) => {
     redirectUrl.searchParams.set('iss', issuer);
     await transactionStore.delete('auth_txn:' + transactionId);
     await authSessionStore.delete(transactionId);
-    return c.redirect(redirectUrl.toString());
+${clearBindingCookieOnDeny}    return c.redirect(redirectUrl.toString());
   }
 
   const session = await authSessionStore.get(transactionId);
@@ -3958,7 +4230,7 @@ consentApp.post('/', async (c) => {
 
   await authSessionStore.delete(transactionId);
 
-  // Redirect back to client with authorization code
+${clearBindingCookieOnSuccess}  // Redirect back to client with authorization code
   const redirectUrl = new URL(responseParams.redirectUri);
   redirectUrl.searchParams.set('code', authCodeData.code);
   if (responseParams.state) {
@@ -4865,10 +5137,11 @@ function reuseCascadeConformanceBlock(features) {
     const PKCE_VERIFIER = 'dBjftJeZ4CVP-mB92K27uhbUJU1p1r_wW1gFWFOEjXk';
     const PKCE_CHALLENGE_S256 = 'E9Melhoa2OwvFrEMTJguCHaoeK1t8URWbuGJSstw-cM';
 
-    // The login -> consent handoff is keyed by transaction_id (not a cookie), so the
-    // flow needs no cookie jar. These helpers only fetch and parse: they make no
-    // assertions and contain no branching, so every check stays in the it() blocks as
-    // an expect(). Test code carries no logic that could drift from the OP's behavior.
+    // The flow carries forward whatever cookie /authorize set, like a browser
+    // would, so it passes with or without --enable transaction-binding. These
+    // helpers only fetch and parse: they make no assertions and contain no
+    // branching, so every check stays in the it() blocks as an expect(). Test code
+    // carries no logic that could drift from the OP's behavior.
     function relativeFrom(location: string | null): string {
       const url = new URL(location ?? '', 'http://localhost');
       return url.pathname + url.search;
@@ -4920,13 +5193,18 @@ function reuseCascadeConformanceBlock(features) {
 
       const authorizeRes = await app.request(authorizeUrl);
       const loginPath = relativeFrom(authorizeRes.headers.get('Location'));
+      // Carry forward whatever cookie /authorize set, exactly as a browser would.
+      // With --enable transaction-binding this is the per-transaction binding
+      // secret the later steps require; without it this is '' and the OP ignores
+      // it, so the same flow works in both builds.
+      const bindingCookie = (authorizeRes.headers.get('Set-Cookie') ?? '').split(';')[0] ?? '';
       const transactionId =
         new URL(loginPath, 'http://localhost').searchParams.get('transaction_id') ?? '';
 
-      const loginGet = await app.request(loginPath);
+      const loginGet = await app.request(loginPath, { headers: { Cookie: bindingCookie } });
       const loginRes = await app.request('/login', {
         method: 'POST',
-        headers: { 'Content-Type': 'application/x-www-form-urlencoded' },
+        headers: { 'Content-Type': 'application/x-www-form-urlencoded', Cookie: bindingCookie },
         body: new URLSearchParams({
           transaction_id: transactionId,
           csrf_token: csrfFrom(await loginGet.text()),
@@ -4936,10 +5214,10 @@ function reuseCascadeConformanceBlock(features) {
       });
       const consentPath = relativeFrom(loginRes.headers.get('Location'));
 
-      const consentGet = await app.request(consentPath);
+      const consentGet = await app.request(consentPath, { headers: { Cookie: bindingCookie } });
       const consentRes = await app.request('/consent', {
         method: 'POST',
-        headers: { 'Content-Type': 'application/x-www-form-urlencoded' },
+        headers: { 'Content-Type': 'application/x-www-form-urlencoded', Cookie: bindingCookie },
         body: new URLSearchParams({
           transaction_id: transactionId,
           csrf_token: csrfFrom(await consentGet.text()),
@@ -5027,10 +5305,11 @@ function reuseCascadeConformanceBlock(features) {
     const PKCE_VERIFIER = 'dBjftJeZ4CVP-mB92K27uhbUJU1p1r_wW1gFWFOEjXk';
     const PKCE_CHALLENGE_S256 = 'E9Melhoa2OwvFrEMTJguCHaoeK1t8URWbuGJSstw-cM';
 
-    // The login -> consent handoff is keyed by transaction_id (not a cookie), so the
-    // flow needs no cookie jar. These helpers only fetch and parse: they make no
-    // assertions and contain no branching, so every check stays in the it() blocks as
-    // an expect(). Test code carries no logic that could drift from the OP's behavior.
+    // The flow carries forward whatever cookie /authorize set, like a browser
+    // would, so it passes with or without --enable transaction-binding. These
+    // helpers only fetch and parse: they make no assertions and contain no
+    // branching, so every check stays in the it() blocks as an expect(). Test code
+    // carries no logic that could drift from the OP's behavior.
     function relativeFrom(location: string | null): string {
       const url = new URL(location ?? '', 'http://localhost');
       return url.pathname + url.search;
@@ -5082,13 +5361,18 @@ function reuseCascadeConformanceBlock(features) {
 
       const authorizeRes = await app.request(authorizeUrl);
       const loginPath = relativeFrom(authorizeRes.headers.get('Location'));
+      // Carry forward whatever cookie /authorize set, exactly as a browser would.
+      // With --enable transaction-binding this is the per-transaction binding
+      // secret the later steps require; without it this is '' and the OP ignores
+      // it, so the same flow works in both builds.
+      const bindingCookie = (authorizeRes.headers.get('Set-Cookie') ?? '').split(';')[0] ?? '';
       const transactionId =
         new URL(loginPath, 'http://localhost').searchParams.get('transaction_id') ?? '';
 
-      const loginGet = await app.request(loginPath);
+      const loginGet = await app.request(loginPath, { headers: { Cookie: bindingCookie } });
       const loginRes = await app.request('/login', {
         method: 'POST',
-        headers: { 'Content-Type': 'application/x-www-form-urlencoded' },
+        headers: { 'Content-Type': 'application/x-www-form-urlencoded', Cookie: bindingCookie },
         body: new URLSearchParams({
           transaction_id: transactionId,
           csrf_token: csrfFrom(await loginGet.text()),
@@ -5098,10 +5382,10 @@ function reuseCascadeConformanceBlock(features) {
       });
       const consentPath = relativeFrom(loginRes.headers.get('Location'));
 
-      const consentGet = await app.request(consentPath);
+      const consentGet = await app.request(consentPath, { headers: { Cookie: bindingCookie } });
       const consentRes = await app.request('/consent', {
         method: 'POST',
-        headers: { 'Content-Type': 'application/x-www-form-urlencoded' },
+        headers: { 'Content-Type': 'application/x-www-form-urlencoded', Cookie: bindingCookie },
         body: new URLSearchParams({
           transaction_id: transactionId,
           csrf_token: csrfFrom(await consentGet.text()),
@@ -5425,6 +5709,355 @@ function requestObjectValueConformanceBlock(features) {
   });
 `;
 }
+export function transactionBindingConformanceBlock(features = DEFAULT_FEATURES) {
+    if (!features.transactionBinding)
+        return transactionBindingDisabledConformanceBlock();
+    return `
+  describe('Auth transaction User-Agent binding', () => {
+    const BINDING_PKCE_CHALLENGE = 'E9Melhoa2OwvFrEMTJguCHaoeK1t8URWbuGJSstw-cM';
+
+    // Pure fetch + parse helpers: no assertions and no branching, so the contract
+    // stays visible in the it() blocks.
+    function bindingRelativeFrom(location: string | null): string {
+      const url = new URL(location ?? '', 'http://localhost');
+      return url.pathname + url.search;
+    }
+
+    function bindingCsrfFrom(html: string): string {
+      return html.match(/name="csrf_token" value="([^"]+)"/)?.[1] ?? '';
+    }
+
+    // Start one authorization request and return everything a browser would hold
+    // after it: where the OP sent us, the transaction id, and the binding cookie.
+    async function startFlow(state: string): Promise<{
+      loginPath: string;
+      transactionId: string;
+      cookie: string;
+    }> {
+      const res = await app.request(
+        '/authorize?response_type=code&client_id=c-conf' +
+        '&redirect_uri=' + encodeURIComponent(REDIRECT_URI) +
+        '&scope=openid&state=' + state + '&prompt=consent' +
+        '&code_challenge=' + BINDING_PKCE_CHALLENGE + '&code_challenge_method=S256',
+      );
+      const loginPath = bindingRelativeFrom(res.headers.get('Location'));
+      return {
+        loginPath,
+        transactionId:
+          new URL(loginPath, 'http://localhost').searchParams.get('transaction_id') ?? '',
+        cookie: (res.headers.get('Set-Cookie') ?? '').split(';')[0] ?? '',
+      };
+    }
+
+    // Log in and reach the consent page as the browser that owns the transaction.
+    async function loginAndReachConsent(flow: {
+      loginPath: string;
+      transactionId: string;
+      cookie: string;
+    }): Promise<{ consentPath: string; consentCsrf: string }> {
+      const loginGet = await app.request(flow.loginPath, {
+        headers: { Cookie: flow.cookie },
+      });
+      const loginRes = await app.request('/login', {
+        method: 'POST',
+        headers: { 'Content-Type': 'application/x-www-form-urlencoded', Cookie: flow.cookie },
+        body: new URLSearchParams({
+          transaction_id: flow.transactionId,
+          csrf_token: bindingCsrfFrom(await loginGet.text()),
+          username: 'testuser',
+          password: 'password',
+        }).toString(),
+      });
+      const consentPath = bindingRelativeFrom(loginRes.headers.get('Location'));
+      const consentGet = await app.request(consentPath, { headers: { Cookie: flow.cookie } });
+      return { consentPath, consentCsrf: bindingCsrfFrom(await consentGet.text()) };
+    }
+
+    // The authorization endpoint issues the binding secret; without it there is
+    // nothing to check the later steps against.
+    it('should set a transaction binding cookie on the redirect to the login page', async () => {
+      const res = await app.request(
+        '/authorize?response_type=code&client_id=c-conf' +
+        '&redirect_uri=' + encodeURIComponent(REDIRECT_URI) +
+        '&scope=openid&state=binding-set&prompt=consent' +
+        '&code_challenge=' + BINDING_PKCE_CHALLENGE + '&code_challenge_method=S256',
+      );
+      const transactionId =
+        new URL(bindingRelativeFrom(res.headers.get('Location')), 'http://localhost')
+          .searchParams.get('transaction_id') ?? '';
+      const setCookie = res.headers.get('Set-Cookie') ?? '';
+
+      expect(res.status).toBe(302);
+      // Named per transaction so two tabs can run two flows at once, and marked
+      // HttpOnly/Secure/SameSite=Lax like the session cookie.
+      expect(setCookie.startsWith('oidc_txn_' + transactionId + '=')).toBe(true);
+      expect(setCookie.endsWith('; HttpOnly; Secure; SameSite=Lax; Path=/; Max-Age=600')).toBe(true);
+    });
+
+    // The csrf_token lives in this HTML. If a leaked transaction_id were enough to
+    // fetch it, the CSRF defense would reduce to the secrecy of a URL parameter.
+    it('should not expose the csrf token for GET /login without the transaction binding cookie', async () => {
+      const flow = await startFlow('binding-login-get');
+
+      const res = await app.request(flow.loginPath);
+      const body = await res.text();
+
+      expect(res.status).toBe(400);
+      expect(body.includes('csrf_token')).toBe(false);
+    });
+
+    it('should return 400 for GET /consent without the transaction binding cookie', async () => {
+      const flow = await startFlow('binding-consent-get');
+      await loginAndReachConsent(flow);
+
+      const res = await app.request('/consent?transaction_id=' + flow.transactionId);
+      const body = await res.text();
+
+      expect(res.status).toBe(400);
+      expect(body.includes('csrf_token')).toBe(false);
+    });
+
+    it('should reject POST /login without the transaction binding cookie', async () => {
+      const flow = await startFlow('binding-login-post');
+      const loginGet = await app.request(flow.loginPath, { headers: { Cookie: flow.cookie } });
+      const csrf = bindingCsrfFrom(await loginGet.text());
+
+      const res = await app.request('/login', {
+        method: 'POST',
+        headers: { 'Content-Type': 'application/x-www-form-urlencoded' },
+        body: new URLSearchParams({
+          transaction_id: flow.transactionId,
+          csrf_token: csrf,
+          username: 'testuser',
+          password: 'password',
+        }).toString(),
+      });
+
+      // Stopped by the OP itself (400), never redirected onward to the client.
+      expect(res.status).toBe(400);
+      expect(res.headers.get('Location')).toBe(null);
+    });
+
+    // The core threat: someone holding transaction_id and a valid csrf_token
+    // (both readable from a shared screen or a browser history entry) must still
+    // not be able to complete the grant.
+    it('should not issue an authorization code for POST /consent without the transaction binding cookie', async () => {
+      const flow = await startFlow('binding-consent-post');
+      const consent = await loginAndReachConsent(flow);
+
+      const res = await app.request('/consent', {
+        method: 'POST',
+        headers: { 'Content-Type': 'application/x-www-form-urlencoded' },
+        body: new URLSearchParams({
+          transaction_id: flow.transactionId,
+          csrf_token: consent.consentCsrf,
+          action: 'approve',
+        }).toString(),
+      });
+
+      expect(res.status).toBe(400);
+      expect(res.headers.get('Location')).toBe(null);
+    });
+
+    // The lured-victim case: the attacker starts their own transaction, so their
+    // cookie is a perfectly valid binding cookie — just not for THIS transaction.
+    it('should not issue an authorization code for POST /consent with another transactions binding cookie', async () => {
+      const victim = await startFlow('binding-victim');
+      const consent = await loginAndReachConsent(victim);
+      const attacker = await startFlow('binding-attacker');
+
+      const res = await app.request('/consent', {
+        method: 'POST',
+        headers: {
+          'Content-Type': 'application/x-www-form-urlencoded',
+          Cookie: attacker.cookie,
+        },
+        body: new URLSearchParams({
+          transaction_id: victim.transactionId,
+          csrf_token: consent.consentCsrf,
+          action: 'approve',
+        }).toString(),
+      });
+
+      expect(res.status).toBe(400);
+      expect(res.headers.get('Location')).toBe(null);
+    });
+
+    it('should reject POST /consent action=deny without the transaction binding cookie', async () => {
+      const flow = await startFlow('binding-deny');
+      const consent = await loginAndReachConsent(flow);
+
+      const res = await app.request('/consent', {
+        method: 'POST',
+        headers: { 'Content-Type': 'application/x-www-form-urlencoded' },
+        body: new URLSearchParams({
+          transaction_id: flow.transactionId,
+          csrf_token: consent.consentCsrf,
+          action: 'deny',
+        }).toString(),
+      });
+
+      expect(res.status).toBe(400);
+      expect(res.headers.get('Location')).toBe(null);
+    });
+
+    // Regression guard: the binding must not break the flow it protects.
+    it('should issue an authorization code for the normal flow with a valid binding cookie', async () => {
+      const flow = await startFlow('binding-happy');
+      const consent = await loginAndReachConsent(flow);
+
+      const res = await app.request('/consent', {
+        method: 'POST',
+        headers: {
+          'Content-Type': 'application/x-www-form-urlencoded',
+          Cookie: flow.cookie,
+        },
+        body: new URLSearchParams({
+          transaction_id: flow.transactionId,
+          csrf_token: consent.consentCsrf,
+          action: 'approve',
+        }).toString(),
+      });
+      const callback = new URL(res.headers.get('Location') ?? '', 'http://localhost');
+
+      expect(res.status).toBe(302);
+      expect(callback.searchParams.get('state')).toBe('binding-happy');
+      expect((callback.searchParams.get('code') ?? '').length).toBe(43);
+      // The finished transaction's cookie is cleared so it cannot pile up.
+      expect(res.headers.get('Set-Cookie')).toBe(
+        'oidc_txn_' + flow.transactionId + '=; HttpOnly; Secure; SameSite=Lax; Path=/; Max-Age=0',
+      );
+    });
+
+    // Two tabs, two clients, at the same time: the cookie is named per
+    // transaction, so neither flow overwrites the other's secret.
+    it('should complete two concurrent authorization flows in the same browser', async () => {
+      const first = await startFlow('binding-tab-one');
+      const second = await startFlow('binding-tab-two');
+      const bothCookies = first.cookie + '; ' + second.cookie;
+
+      const firstConsent = await loginAndReachConsent({ ...first, cookie: bothCookies });
+      const secondConsent = await loginAndReachConsent({ ...second, cookie: bothCookies });
+
+      const firstRes = await app.request('/consent', {
+        method: 'POST',
+        headers: { 'Content-Type': 'application/x-www-form-urlencoded', Cookie: bothCookies },
+        body: new URLSearchParams({
+          transaction_id: first.transactionId,
+          csrf_token: firstConsent.consentCsrf,
+          action: 'approve',
+        }).toString(),
+      });
+      const secondRes = await app.request('/consent', {
+        method: 'POST',
+        headers: { 'Content-Type': 'application/x-www-form-urlencoded', Cookie: bothCookies },
+        body: new URLSearchParams({
+          transaction_id: second.transactionId,
+          csrf_token: secondConsent.consentCsrf,
+          action: 'approve',
+        }).toString(),
+      });
+      const firstCallback = new URL(firstRes.headers.get('Location') ?? '', 'http://localhost');
+      const secondCallback = new URL(secondRes.headers.get('Location') ?? '', 'http://localhost');
+
+      expect(firstCallback.searchParams.get('state')).toBe('binding-tab-one');
+      expect(secondCallback.searchParams.get('state')).toBe('binding-tab-two');
+      expect((firstCallback.searchParams.get('code') ?? '').length).toBe(43);
+      expect((secondCallback.searchParams.get('code') ?? '').length).toBe(43);
+    });
+  });
+`;
+}
+function transactionBindingDisabledConformanceBlock() {
+    return `
+  describe('Auth transaction User-Agent binding (disabled by default)', () => {
+    const NO_BINDING_PKCE_CHALLENGE = 'E9Melhoa2OwvFrEMTJguCHaoeK1t8URWbuGJSstw-cM';
+
+    function noBindingRelativeFrom(location: string | null): string {
+      const url = new URL(location ?? '', 'http://localhost');
+      return url.pathname + url.search;
+    }
+
+    function noBindingCsrfFrom(html: string): string {
+      return html.match(/name="csrf_token" value="([^"]+)"/)?.[1] ?? '';
+    }
+
+    // Drive the whole flow WITHOUT ever sending a Cookie header, exactly as a
+    // curl session would. No assertions or branching in here.
+    async function flowWithoutCookies(state: string): Promise<{
+      authorizeSetCookie: string | null;
+      loginFormStatus: number;
+      consentFormStatus: number;
+      consentFormHasCsrf: boolean;
+      callbackCode: string;
+      callbackState: string | null;
+    }> {
+      const authorizeRes = await app.request(
+        '/authorize?response_type=code&client_id=c-conf' +
+        '&redirect_uri=' + encodeURIComponent(REDIRECT_URI) +
+        '&scope=openid&state=' + state + '&prompt=consent' +
+        '&code_challenge=' + NO_BINDING_PKCE_CHALLENGE + '&code_challenge_method=S256',
+      );
+      const loginPath = noBindingRelativeFrom(authorizeRes.headers.get('Location'));
+      const transactionId =
+        new URL(loginPath, 'http://localhost').searchParams.get('transaction_id') ?? '';
+
+      const loginGet = await app.request(loginPath);
+      const loginRes = await app.request('/login', {
+        method: 'POST',
+        headers: { 'Content-Type': 'application/x-www-form-urlencoded' },
+        body: new URLSearchParams({
+          transaction_id: transactionId,
+          csrf_token: noBindingCsrfFrom(await loginGet.text()),
+          username: 'testuser',
+          password: 'password',
+        }).toString(),
+      });
+
+      const consentPath = noBindingRelativeFrom(loginRes.headers.get('Location'));
+      const consentGet = await app.request(consentPath);
+      const consentHtml = await consentGet.text();
+      const consentRes = await app.request('/consent', {
+        method: 'POST',
+        headers: { 'Content-Type': 'application/x-www-form-urlencoded' },
+        body: new URLSearchParams({
+          transaction_id: transactionId,
+          csrf_token: noBindingCsrfFrom(consentHtml),
+          action: 'approve',
+        }).toString(),
+      });
+      const callback = new URL(consentRes.headers.get('Location') ?? '', 'http://localhost');
+
+      return {
+        authorizeSetCookie: authorizeRes.headers.get('Set-Cookie'),
+        loginFormStatus: loginGet.status,
+        consentFormStatus: consentGet.status,
+        consentFormHasCsrf: noBindingCsrfFrom(consentHtml).length > 0,
+        callbackCode: callback.searchParams.get('code') ?? '',
+        callbackState: callback.searchParams.get('state'),
+      };
+    }
+
+    it('should not set any binding cookie on the redirect to the login page', async () => {
+      const flow = await flowWithoutCookies('no-binding-cookie');
+
+      expect(flow.authorizeSetCookie).toBe(null);
+    });
+
+    // The whole point of leaving this off by default: transaction_id alone is
+    // enough to walk the flow, so the OP can be explored by hand.
+    it('should complete the whole flow without sending a single cookie', async () => {
+      const flow = await flowWithoutCookies('no-binding-flow');
+
+      expect(flow.loginFormStatus).toBe(200);
+      expect(flow.consentFormStatus).toBe(200);
+      expect(flow.consentFormHasCsrf).toBe(true);
+      expect(flow.callbackState).toBe('no-binding-flow');
+      expect(flow.callbackCode.length).toBe(43);
+    });
+  });
+`;
+}
 export function customViewConformanceTestBlock() {
     return `
   describe('custom view rendering (ViewResult / renderView)', () => {
@@ -5475,8 +6108,13 @@ export function customViewConformanceTestBlock() {
         '&code_challenge=' + PKCE_CHALLENGE_S256 + '&code_challenge_method=S256';
       const authorizeRes = await app.request(authorizeUrl);
       const loginUrl = new URL(authorizeRes.headers.get('Location') ?? '', 'http://localhost');
+      // Carry forward whatever cookie /authorize set, exactly as a browser would.
+      // With --enable transaction-binding this is the per-transaction binding
+      // secret the later steps require; without it this is '' and the OP ignores
+      // it, so the same flow works in both builds.
+      const bindingCookie = (authorizeRes.headers.get('Set-Cookie') ?? '').split(';')[0] ?? '';
 
-      const res = await app.request(loginUrl.pathname + loginUrl.search);
+      const res = await app.request(loginUrl.pathname + loginUrl.search, { headers: { Cookie: bindingCookie } });
 
       // The login body carries a dynamic transaction_id / csrf_token, so the
       // status + content type pin that renderView delivered a text/html Response
@@ -5542,13 +6180,18 @@ async function conformanceAuthorizationCode(scope: string): Promise<string> {
       '&code_challenge=' + CONFORMANCE_PKCE_CHALLENGE + '&code_challenge_method=S256',
   );
   const loginPath = relativeFrom(authorizeRes.headers.get('Location'));
+  // Carry forward whatever cookie /authorize set, exactly as a browser would.
+  // With --enable transaction-binding this is the per-transaction binding
+  // secret the later steps require; without it this is '' and the OP ignores
+  // it, so the same flow works in both builds.
+  const bindingCookie = (authorizeRes.headers.get('Set-Cookie') ?? '').split(';')[0] ?? '';
   const transactionId =
     new URL(loginPath, 'http://localhost').searchParams.get('transaction_id') ?? '';
 
-  const loginGet = await app.request(loginPath);
+  const loginGet = await app.request(loginPath, { headers: { Cookie: bindingCookie } });
   const loginRes = await app.request('/login', {
     method: 'POST',
-    headers: { 'Content-Type': 'application/x-www-form-urlencoded' },
+    headers: { 'Content-Type': 'application/x-www-form-urlencoded', Cookie: bindingCookie },
     body: new URLSearchParams({
       transaction_id: transactionId,
       csrf_token: csrfFrom(await loginGet.text()),
@@ -5558,10 +6201,10 @@ async function conformanceAuthorizationCode(scope: string): Promise<string> {
   });
 
   const consentPath = relativeFrom(loginRes.headers.get('Location'));
-  const consentGet = await app.request(consentPath);
+  const consentGet = await app.request(consentPath, { headers: { Cookie: bindingCookie } });
   const consentRes = await app.request('/consent', {
     method: 'POST',
-    headers: { 'Content-Type': 'application/x-www-form-urlencoded' },
+    headers: { 'Content-Type': 'application/x-www-form-urlencoded', Cookie: bindingCookie },
     body: new URLSearchParams({
       transaction_id: transactionId,
       csrf_token: csrfFrom(await consentGet.text()),
@@ -6023,14 +6666,19 @@ export function pkceDisabledConformanceBlock(features) {
       );
       expect(authorizeRes.status).toBe(302);
       const loginPath = relativePathFrom(authorizeRes.headers.get('Location'));
+      // Carry forward whatever cookie /authorize set, exactly as a browser would.
+      // With --enable transaction-binding this is the per-transaction binding
+      // secret the later steps require; without it this is '' and the OP ignores
+      // it, so the same flow works in both builds.
+      const bindingCookie = (authorizeRes.headers.get('Set-Cookie') ?? '').split(';')[0] ?? '';
       expect(loginPath.startsWith('/login?')).toBe(true);
       const transactionId =
         new URL(loginPath, 'http://localhost').searchParams.get('transaction_id') ?? '';
 
-      const loginGet = await app.request(loginPath);
+      const loginGet = await app.request(loginPath, { headers: { Cookie: bindingCookie } });
       const loginRes = await app.request('/login', {
         method: 'POST',
-        headers: { 'Content-Type': 'application/x-www-form-urlencoded' },
+        headers: { 'Content-Type': 'application/x-www-form-urlencoded', Cookie: bindingCookie },
         body: new URLSearchParams({
           transaction_id: transactionId,
           csrf_token: csrfTokenFrom(await loginGet.text()),
@@ -6042,10 +6690,10 @@ export function pkceDisabledConformanceBlock(features) {
       const consentPath = relativePathFrom(loginRes.headers.get('Location'));
       expect(consentPath.startsWith('/consent?')).toBe(true);
 
-      const consentGet = await app.request(consentPath);
+      const consentGet = await app.request(consentPath, { headers: { Cookie: bindingCookie } });
       const consentRes = await app.request('/consent', {
         method: 'POST',
-        headers: { 'Content-Type': 'application/x-www-form-urlencoded' },
+        headers: { 'Content-Type': 'application/x-www-form-urlencoded', Cookie: bindingCookie },
         body: new URLSearchParams({
           transaction_id: transactionId,
           csrf_token: csrfTokenFrom(await consentGet.text()),
@@ -6099,12 +6747,17 @@ export function tokenEndpointAuthMethodsConformanceBlock() {
         '&code_challenge=E9Melhoa2OwvFrEMTJguCHaoeK1t8URWbuGJSstw-cM&code_challenge_method=S256',
       );
       const loginPath = relativeLocation(authorizeRes.headers.get('Location'));
+      // Carry forward whatever cookie /authorize set, exactly as a browser would.
+      // With --enable transaction-binding this is the per-transaction binding
+      // secret the later steps require; without it this is '' and the OP ignores
+      // it, so the same flow works in both builds.
+      const bindingCookie = (authorizeRes.headers.get('Set-Cookie') ?? '').split(';')[0] ?? '';
       const transactionId =
         new URL(loginPath, 'http://localhost').searchParams.get('transaction_id') ?? '';
-      const loginGet = await app.request(loginPath);
+      const loginGet = await app.request(loginPath, { headers: { Cookie: bindingCookie } });
       const loginRes = await app.request('/login', {
         method: 'POST',
-        headers: { 'Content-Type': 'application/x-www-form-urlencoded' },
+        headers: { 'Content-Type': 'application/x-www-form-urlencoded', Cookie: bindingCookie },
         body: new URLSearchParams({
           transaction_id: transactionId,
           csrf_token: csrfTokenFrom(await loginGet.text()),
@@ -6113,10 +6766,10 @@ export function tokenEndpointAuthMethodsConformanceBlock() {
         }).toString(),
       });
       const consentPath = relativeLocation(loginRes.headers.get('Location'));
-      const consentGet = await app.request(consentPath);
+      const consentGet = await app.request(consentPath, { headers: { Cookie: bindingCookie } });
       const consentRes = await app.request('/consent', {
         method: 'POST',
-        headers: { 'Content-Type': 'application/x-www-form-urlencoded' },
+        headers: { 'Content-Type': 'application/x-www-form-urlencoded', Cookie: bindingCookie },
         body: new URLSearchParams({
           transaction_id: transactionId,
           csrf_token: csrfTokenFrom(await consentGet.text()),
@@ -6162,12 +6815,17 @@ export function tokenEndpointAuthMethodsConformanceBlock() {
         '&code_challenge=E9Melhoa2OwvFrEMTJguCHaoeK1t8URWbuGJSstw-cM&code_challenge_method=S256',
       );
       const loginPath = relativeLocation(authorizeRes.headers.get('Location'));
+      // Carry forward whatever cookie /authorize set, exactly as a browser would.
+      // With --enable transaction-binding this is the per-transaction binding
+      // secret the later steps require; without it this is '' and the OP ignores
+      // it, so the same flow works in both builds.
+      const bindingCookie = (authorizeRes.headers.get('Set-Cookie') ?? '').split(';')[0] ?? '';
       const transactionId =
         new URL(loginPath, 'http://localhost').searchParams.get('transaction_id') ?? '';
-      const loginGet = await app.request(loginPath);
+      const loginGet = await app.request(loginPath, { headers: { Cookie: bindingCookie } });
       const loginRes = await app.request('/login', {
         method: 'POST',
-        headers: { 'Content-Type': 'application/x-www-form-urlencoded' },
+        headers: { 'Content-Type': 'application/x-www-form-urlencoded', Cookie: bindingCookie },
         body: new URLSearchParams({
           transaction_id: transactionId,
           csrf_token: csrfTokenFrom(await loginGet.text()),
@@ -6176,10 +6834,10 @@ export function tokenEndpointAuthMethodsConformanceBlock() {
         }).toString(),
       });
       const consentPath = relativeLocation(loginRes.headers.get('Location'));
-      const consentGet = await app.request(consentPath);
+      const consentGet = await app.request(consentPath, { headers: { Cookie: bindingCookie } });
       const consentRes = await app.request('/consent', {
         method: 'POST',
-        headers: { 'Content-Type': 'application/x-www-form-urlencoded' },
+        headers: { 'Content-Type': 'application/x-www-form-urlencoded', Cookie: bindingCookie },
         body: new URLSearchParams({
           transaction_id: transactionId,
           csrf_token: csrfTokenFrom(await consentGet.text()),
@@ -6223,12 +6881,17 @@ export function tokenEndpointAuthMethodsConformanceBlock() {
         '&code_challenge=E9Melhoa2OwvFrEMTJguCHaoeK1t8URWbuGJSstw-cM&code_challenge_method=S256',
       );
       const loginPath = relativeLocation(authorizeRes.headers.get('Location'));
+      // Carry forward whatever cookie /authorize set, exactly as a browser would.
+      // With --enable transaction-binding this is the per-transaction binding
+      // secret the later steps require; without it this is '' and the OP ignores
+      // it, so the same flow works in both builds.
+      const bindingCookie = (authorizeRes.headers.get('Set-Cookie') ?? '').split(';')[0] ?? '';
       const transactionId =
         new URL(loginPath, 'http://localhost').searchParams.get('transaction_id') ?? '';
-      const loginGet = await app.request(loginPath);
+      const loginGet = await app.request(loginPath, { headers: { Cookie: bindingCookie } });
       const loginRes = await app.request('/login', {
         method: 'POST',
-        headers: { 'Content-Type': 'application/x-www-form-urlencoded' },
+        headers: { 'Content-Type': 'application/x-www-form-urlencoded', Cookie: bindingCookie },
         body: new URLSearchParams({
           transaction_id: transactionId,
           csrf_token: csrfTokenFrom(await loginGet.text()),
@@ -6237,10 +6900,10 @@ export function tokenEndpointAuthMethodsConformanceBlock() {
         }).toString(),
       });
       const consentPath = relativeLocation(loginRes.headers.get('Location'));
-      const consentGet = await app.request(consentPath);
+      const consentGet = await app.request(consentPath, { headers: { Cookie: bindingCookie } });
       const consentRes = await app.request('/consent', {
         method: 'POST',
-        headers: { 'Content-Type': 'application/x-www-form-urlencoded' },
+        headers: { 'Content-Type': 'application/x-www-form-urlencoded', Cookie: bindingCookie },
         body: new URLSearchParams({
           transaction_id: transactionId,
           csrf_token: csrfTokenFrom(await consentGet.text()),
@@ -6391,11 +7054,16 @@ ${corsPreflightTest}
       );
       expect(authorizeRes.status).toBe(302);
       const loginUrl = new URL(authorizeRes.headers.get('Location') ?? '', 'http://localhost');
+      // Carry forward whatever cookie /authorize set, exactly as a browser would.
+      // With --enable transaction-binding this is the per-transaction binding
+      // secret the later steps require; without it this is '' and the OP ignores
+      // it, so the same flow works in both builds.
+      const bindingCookie = (authorizeRes.headers.get('Set-Cookie') ?? '').split(';')[0] ?? '';
       const transactionId = loginUrl.searchParams.get('transaction_id') ?? '';
-      const loginGet = await app.request(loginUrl.pathname + loginUrl.search);
+      const loginGet = await app.request(loginUrl.pathname + loginUrl.search, { headers: { Cookie: bindingCookie } });
       const loginRes = await app.request('/login', {
         method: 'POST',
-        headers: { 'Content-Type': 'application/x-www-form-urlencoded' },
+        headers: { 'Content-Type': 'application/x-www-form-urlencoded', Cookie: bindingCookie },
         body: new URLSearchParams({
           transaction_id: transactionId,
           csrf_token: csrfTokenFrom(await loginGet.text()),
@@ -6405,10 +7073,12 @@ ${corsPreflightTest}
       });
       expect(loginRes.status).toBe(302);
       const consentUrl = new URL(loginRes.headers.get('Location') ?? '', 'http://localhost');
-      const consentGet = await app.request(consentUrl.pathname + consentUrl.search);
+      const consentGet = await app.request(consentUrl.pathname + consentUrl.search, {
+        headers: { Cookie: bindingCookie },
+      });
       const denyRes = await app.request('/consent', {
         method: 'POST',
-        headers: { 'Content-Type': 'application/x-www-form-urlencoded' },
+        headers: { 'Content-Type': 'application/x-www-form-urlencoded', Cookie: bindingCookie },
         body: new URLSearchParams({
           transaction_id: transactionId,
           csrf_token: csrfTokenFrom(await consentGet.text()),
@@ -6503,12 +7173,17 @@ export function idTokenHintConformanceBlock() {
         '&code_challenge=' + HINT_PKCE_CHALLENGE + '&code_challenge_method=S256',
       );
       const loginPath = hintRelativeLocation(authorizeRes.headers.get('Location'));
+      // Carry forward whatever cookie /authorize set, exactly as a browser would.
+      // With --enable transaction-binding this is the per-transaction binding
+      // secret the later steps require; without it this is '' and the OP ignores
+      // it, so the same flow works in both builds.
+      const bindingCookie = (authorizeRes.headers.get('Set-Cookie') ?? '').split(';')[0] ?? '';
       const transactionId =
         new URL(loginPath, 'http://localhost').searchParams.get('transaction_id') ?? '';
-      const loginGet = await app.request(loginPath);
+      const loginGet = await app.request(loginPath, { headers: { Cookie: bindingCookie } });
       const loginRes = await app.request('/login', {
         method: 'POST',
-        headers: { 'Content-Type': 'application/x-www-form-urlencoded' },
+        headers: { 'Content-Type': 'application/x-www-form-urlencoded', Cookie: bindingCookie },
         body: new URLSearchParams({
           transaction_id: transactionId,
           csrf_token: hintCsrfToken(await loginGet.text()),
@@ -6518,10 +7193,10 @@ export function idTokenHintConformanceBlock() {
       });
       hintSessionCookie = loginRes.headers.get('Set-Cookie') ?? '';
       const consentPath = hintRelativeLocation(loginRes.headers.get('Location'));
-      const consentGet = await app.request(consentPath);
+      const consentGet = await app.request(consentPath, { headers: { Cookie: bindingCookie } });
       await app.request('/consent', {
         method: 'POST',
-        headers: { 'Content-Type': 'application/x-www-form-urlencoded' },
+        headers: { 'Content-Type': 'application/x-www-form-urlencoded', Cookie: bindingCookie },
         body: new URLSearchParams({
           transaction_id: transactionId,
           csrf_token: hintCsrfToken(await consentGet.text()),
@@ -6720,13 +7395,18 @@ export function consentWithdrawalConformanceBlock(features) {
       );
       expect(authorizeRes.status).toBe(302);
       const loginPath = relativeLocation(authorizeRes.headers.get('Location'));
+      // Carry forward whatever cookie /authorize set, exactly as a browser would.
+      // With --enable transaction-binding this is the per-transaction binding
+      // secret the later steps require; without it this is '' and the OP ignores
+      // it, so the same flow works in both builds.
+      const bindingCookie = (authorizeRes.headers.get('Set-Cookie') ?? '').split(';')[0] ?? '';
       const transactionId =
         new URL(loginPath, 'http://localhost').searchParams.get('transaction_id') ?? '';
 
-      const loginGet = await app.request(loginPath);
+      const loginGet = await app.request(loginPath, { headers: { Cookie: bindingCookie } });
       const loginRes = await app.request('/login', {
         method: 'POST',
-        headers: { 'Content-Type': 'application/x-www-form-urlencoded' },
+        headers: { 'Content-Type': 'application/x-www-form-urlencoded', Cookie: bindingCookie },
         body: new URLSearchParams({
           transaction_id: transactionId,
           csrf_token: csrfTokenFrom(await loginGet.text()),
@@ -6737,10 +7417,10 @@ export function consentWithdrawalConformanceBlock(features) {
       expect(loginRes.status).toBe(302);
       const sessionCookie = loginRes.headers.get('Set-Cookie') ?? '';
       const consentPath = relativeLocation(loginRes.headers.get('Location'));
-      const consentGet = await app.request(consentPath);
+      const consentGet = await app.request(consentPath, { headers: { Cookie: bindingCookie } });
       const consentRes = await app.request('/consent', {
         method: 'POST',
-        headers: { 'Content-Type': 'application/x-www-form-urlencoded' },
+        headers: { 'Content-Type': 'application/x-www-form-urlencoded', Cookie: bindingCookie },
         body: new URLSearchParams({
           transaction_id: transactionId,
           csrf_token: csrfTokenFrom(await consentGet.text()),
@@ -6919,13 +7599,18 @@ export function tokenExchangeConformanceBlock(features) {
 
       const authorizeRes = await app.request(authorizeUrl);
       const loginPath = relativeFrom(authorizeRes.headers.get('Location'));
+      // Carry forward whatever cookie /authorize set, exactly as a browser would.
+      // With --enable transaction-binding this is the per-transaction binding
+      // secret the later steps require; without it this is '' and the OP ignores
+      // it, so the same flow works in both builds.
+      const bindingCookie = (authorizeRes.headers.get('Set-Cookie') ?? '').split(';')[0] ?? '';
       const transactionId =
         new URL(loginPath, 'http://localhost').searchParams.get('transaction_id') ?? '';
 
-      const loginGet = await app.request(loginPath);
+      const loginGet = await app.request(loginPath, { headers: { Cookie: bindingCookie } });
       const loginRes = await app.request('/login', {
         method: 'POST',
-        headers: { 'Content-Type': 'application/x-www-form-urlencoded' },
+        headers: { 'Content-Type': 'application/x-www-form-urlencoded', Cookie: bindingCookie },
         body: new URLSearchParams({
           transaction_id: transactionId,
           csrf_token: csrfFrom(await loginGet.text()),
@@ -6935,10 +7620,10 @@ export function tokenExchangeConformanceBlock(features) {
       });
       const consentPath = relativeFrom(loginRes.headers.get('Location'));
 
-      const consentGet = await app.request(consentPath);
+      const consentGet = await app.request(consentPath, { headers: { Cookie: bindingCookie } });
       const consentRes = await app.request('/consent', {
         method: 'POST',
-        headers: { 'Content-Type': 'application/x-www-form-urlencoded' },
+        headers: { 'Content-Type': 'application/x-www-form-urlencoded', Cookie: bindingCookie },
         body: new URLSearchParams({
           transaction_id: transactionId,
           csrf_token: csrfFrom(await consentGet.text()),
@@ -7578,12 +8263,17 @@ export function parConformanceBlock(features) {
           '/authorize?client_id=c-conf&request_uri=' + encodeURIComponent(requestUri),
         );
         const loginPath = relativeFrom(authorizeRes.headers.get('Location'));
+        // Carry forward whatever cookie /authorize set, exactly as a browser would.
+        // With --enable transaction-binding this is the per-transaction binding
+        // secret the later steps require; without it this is '' and the OP ignores
+        // it, so the same flow works in both builds.
+        const bindingCookie = (authorizeRes.headers.get('Set-Cookie') ?? '').split(';')[0] ?? '';
         const transactionId =
           new URL(loginPath, 'http://localhost').searchParams.get('transaction_id') ?? '';
-        const loginGet = await app.request(loginPath);
+        const loginGet = await app.request(loginPath, { headers: { Cookie: bindingCookie } });
         const loginRes = await app.request('/login', {
           method: 'POST',
-          headers: { 'Content-Type': 'application/x-www-form-urlencoded' },
+          headers: { 'Content-Type': 'application/x-www-form-urlencoded', Cookie: bindingCookie },
           body: new URLSearchParams({
             transaction_id: transactionId,
             csrf_token: csrfFrom(await loginGet.text()),
@@ -7592,10 +8282,10 @@ export function parConformanceBlock(features) {
           }).toString(),
         });
         const consentPath = relativeFrom(loginRes.headers.get('Location'));
-        const consentGet = await app.request(consentPath);
+        const consentGet = await app.request(consentPath, { headers: { Cookie: bindingCookie } });
         const consentRes = await app.request('/consent', {
           method: 'POST',
-          headers: { 'Content-Type': 'application/x-www-form-urlencoded' },
+          headers: { 'Content-Type': 'application/x-www-form-urlencoded', Cookie: bindingCookie },
           body: new URLSearchParams({
             transaction_id: transactionId,
             csrf_token: csrfFrom(await consentGet.text()),
@@ -7639,12 +8329,17 @@ export function parConformanceBlock(features) {
             encodeURIComponent(requestUri),
         );
         const loginPath = relativeFrom(authorizeRes.headers.get('Location'));
+        // Carry forward whatever cookie /authorize set, exactly as a browser would.
+        // With --enable transaction-binding this is the per-transaction binding
+        // secret the later steps require; without it this is '' and the OP ignores
+        // it, so the same flow works in both builds.
+        const bindingCookie = (authorizeRes.headers.get('Set-Cookie') ?? '').split(';')[0] ?? '';
         const transactionId =
           new URL(loginPath, 'http://localhost').searchParams.get('transaction_id') ?? '';
-        const loginGet = await app.request(loginPath);
+        const loginGet = await app.request(loginPath, { headers: { Cookie: bindingCookie } });
         const loginRes = await app.request('/login', {
           method: 'POST',
-          headers: { 'Content-Type': 'application/x-www-form-urlencoded' },
+          headers: { 'Content-Type': 'application/x-www-form-urlencoded', Cookie: bindingCookie },
           body: new URLSearchParams({
             transaction_id: transactionId,
             csrf_token: csrfFrom(await loginGet.text()),
@@ -7653,7 +8348,7 @@ export function parConformanceBlock(features) {
           }).toString(),
         });
         const consentPath = relativeFrom(loginRes.headers.get('Location'));
-        const consentHtml = await (await app.request(consentPath)).text();
+        const consentHtml = await (await app.request(consentPath, { headers: { Cookie: bindingCookie } })).text();
 
         expect(authorizeRes.status).toBe(302);
         // The consent screen lists the pushed scope, not the tampered one.
@@ -8309,7 +9004,7 @@ ${introspectionConformanceBlock(features)}
       });
     });
   });
-${customViewConformanceTestBlock()}${endpointBehaviorConformanceBlock(features, true)}${idTokenHintConformanceBlock()}${consentWithdrawalConformanceBlock(features)}${reuseFlowConformanceTestBlock(features)}${revocationDisabledConformanceBlock(features)}${tokenEndpointAuthMethodsConformanceBlock()}${pkceDisabledConformanceBlock(features)}${parConformanceBlock(features)}${tokenExchangeConformanceBlock(features)}});
+${transactionBindingConformanceBlock(features)}${customViewConformanceTestBlock()}${endpointBehaviorConformanceBlock(features, true)}${idTokenHintConformanceBlock()}${consentWithdrawalConformanceBlock(features)}${reuseFlowConformanceTestBlock(features)}${revocationDisabledConformanceBlock(features)}${tokenEndpointAuthMethodsConformanceBlock()}${pkceDisabledConformanceBlock(features)}${parConformanceBlock(features)}${tokenExchangeConformanceBlock(features)}});
 `;
 }
 //# sourceMappingURL=templates.js.map